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Each quarter, Akamai will be publishing a quarterly “State of the Internet” report. This report 
will include data gathered from across Akamai’s global server network about attack traffic 
and broadband adoption, as well as trends seen in this data over time. It will also aggregate 
publicly available news and information about notable events seen throughout the quarter, 
including Denial of Service attacks, Web site hacks, and network events, including outages 
and new connections. 


During the fourth quarter of 2008, Akamai observed attack traffic originating from 193 
unique countries around the world. The United States and China were the two largest attack 
traffic sources, accounting for over 42% of observed traffic in total. Akamai observed attack 
traffic targeted at more than 20,000 unique ports, with the top 10 ports seeing over 77% of 
the observed attack traffic. Web site hacks and Web-based exploits were regularly in the news 
during the quarter, as was a proof-of-concept exploit for a vulnerability in SSL, the underlying 
mechanism that secures financial and retail transactions, among others, across the Web. 


Notable network outages in the fourth quarter were due to submarine cables in the 
Mediterranean being severed, as well as two major Internet backbone providers de-peering 
their networks from one another. Notable Web site outages in the fourth quarter were 
attributed to increased traffic, hardware failure, and power outages. 
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announcement of WiMAX and 3G broadband services in a number of countries, the launch 
of higher speed cable broadband services based on DOCSIS 3.0, and additional fiber-to-the- 
home services that will bring extremely high-speed connections to subscribers in Switzerland, 
Brazil, India, Spain, Italy, and Russia. 


Akamai observed a nearly six percent increase (from the third quarter 2008) globally in the 
number of unique IP addresses connecting to Akamai’s network, and a 28% increase from 
the end of 2007. From a global connection speed perspective, South Korea had the highest 
levels of “high broadband” (>5 Mbps) connectivity for the fourth consecutive quarter, and 
the highest average connection speed, at 15 Mbps. In the United States, Delaware also 
maintained its top position, with 62% of connections to Akamai occurring at 5 Mbps or 
greater, and the highest average connection speed in the United States, at 7.3 Mbps. Looking 
at observed “narrowband” (<256 Kbps) connections, Mayotte and Equatorial Guinea were 
the “slowest” countries, with 98% and 96% of connections to Akamai, respectively, occurring 
at speeds below 256 Kbps. In the United States, the District of Columbia continued to have 
the highest percentage of observed connections below 256 Kbps. However, this was down 
nearly seven percent from the prior quarter, and over 42% from the end of 2007. 





The “spinning globe” featured in the Akamai NOCC represents where Akamai servers are located and how much traffic they are seeing. 
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Introduction 


Akamai's globally distributed network of servers allows us to gather massive 
amounts of information on many metrics, including connection speeds, attack 
traffic, and network connectivity/availabilityatency problems, as well as user 
behavior and traffic patterns on leading Web sites. 


In the fourth quarter of 2008, observed distributed denial of service (DDoS) 
attack traffic continued to target a consistent set of ports, though it appears 
that some are now being targeted by a new set of network worms. In addition, 
it appears that spikes in attack traffic may be correlated with patch releases or 
security advisories issued by Microsoft, as hackers rush to exploit vulnerabilities 
before system administrators can apply software patches. 


Two large-scale network outages occurred during the quarter, as undersea 
cables were once again severed in the Mediterranean, and as Sprint-Nextel 
de-peered their network from Cogent Communications. However, global 
connectivity continued to become more robust, with new WIMAX and 3G 
mobile broadband services being announced or launching in a number of 
countries, and the introduction of DOCSIS 3.0 services and additional fiber- 
to-the-home initiatives, which are bringing higher speed connectivity to 
subscribers in multiple countries. 


In the fourth quarter, six countries connected to Akamai’s network at average 
speeds in excess of 5 Mbps, and for the year, many countries showed 
significant increases in their levels of high broadband (>5 Mbps) adoption. 
Decreases in the percentage of narrowband (<256 Kbps) connections to 
Akamai were also seen both internationally and in the United States, likely due, 
in part, to the growth in availability of, and options for, broadband connectivity. 
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Akamai maintains a distributed set of agents deployed 
across the Internet that serve to monitor attack traffic. 
Based on the data collected by these agents, Akamai 
is able to identify the top countries from which attack 
traffic originates, as well as the top ports targeted 

by these attacks. (Ports are network layer protocol 
identifiers.) This section, in part, provides insight into 
Internet attack traffic, as observed and measured by 
Akamai, during the fourth quarter of 2008. While 
some quarter-over-quarter trending may be discussed, 
it is expected that both the top countries and top 
ports will change on a quarterly basis. 


This section also includes information on selected 
DDoS attacks, Web site hacking attempts, Web-based 
exploits, and other attacks and events as published 

in the media during the fourth quarter of 2008. Note 
that Akamai does not release information on attacks 
on specific customer sites and that selected published 
reports are simply compiled here. 


Country % Traffic Q3 08% 





Figure 1: Attack Traffic, Top Originating Countries 
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2.1 Attack Traffic, Top Originating Countries 
During the fourth quarter of 2008, Akamai observed 
attack traffic originating from 193 unique countries 
around the world, up nearly 8% from the third quarter 
count of 179 countries. This quarter, the United States 
moved into the first place slot for the first time in 2008, 
after placing second to China or Japan throughout 

the year. Argentina returned to the top 10 again in the 
fourth quarter — it was ranked fifth for first quarter 
attack traffic. Throughout 2008, the United States, 
China, Taiwan, South Korea, and Japan were consistently 
among the top 10 countries that generated the highest 
percentages of attack traffic. 


The trend in attack traffic distribution continues to be 
relatively consistent with the prior quarters, with the 

top 10 countries as the source for just under 72% of 
observed attack traffic. (This is down slightly from prior 
quarters, where the top 10 countries accounted for 
74-78% of observed attack traffic.) The list of countries 
within the top 10 appears to be getting more consistent, 
as observed across 2008 — the five countries listed above 
appeared in the list during all four quarters, while Russia, 
Germany, and Brazil each held spots in the top 10 during 
three of the four quarters in 2008. 
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In December, IT security firm Sophos published! its 
Security Threat Report 2009, which examined the security 
threat landscape over the course of 2008. The report 
noted that the top 5 malware-hosting countries in 2008 
consisted of the United States, China (including Hong 
Kong), Russia, Germany, and South Korea. It is interest- 
ing to note that these countries have also all consistently 
been among the top 10 countries from which Akamai 
has observed attack traffic originating in during 2008. 


2.2 Attack Traffic, Top Target Ports 

During the fourth quarter of 2008, Akamai observed 
attack traffic targeted at just over 20,800 unique 

ports, over eight times more than in the third quarter. 
Consistent with prior quarters, some of the attack traffic 
targeted services on well-known ports. Due to the 
significant growth in port count, the attack traffic was 
slightly less concentrated than in prior quarters, with the 
top 10 ports responsible for only 77% of the observed 
attack traffic. (This is down from an 85% or greater 
concentration during prior quarters of 2008.) While it 

is unclear exactly what is accounting for the growth in 
targeted port count, data from fourth quarter monitoring 
shows that the United States is clearly responsible for this 
growth during the quarter, with originating attack traffic 







OTHER Microsoft-DS 


destined for over 20,200 unique ports. Obviously, there is 
a significant “long tail” that occurs — the top 200 target 
ports only account for 73% of the observed attack traffic 
from the United States. 


For the third consecutive quarter, Port 445 (Microsoft- 
DS) held the first place spot, with a slightly higher 
percentage of the overall observed traffic than in the 
third quarter, and still below second quarter levels. This 
port represented over half of the attack traffic observed 
from Argentina in the fourth quarter, approximately a 
quarter of the attack traffic from the United States and 
Russia, and around a third of observed attack traffic 
coming from Taiwan, Japan, Brazil, and Germany. While 
this port was previously associated with the Sasser 
worm, it appears that it is also? associated with the 
Gimmiv.A worm, which exploited a vulnerability? that 
was considered to be significant enough to ultimately be 
addressed by Microsoft in a patch‘ released outside of 
their normal “Patch Tuesday” cycle. The Conficker worm 
is reported to also be using Port 445 and exploiting 

this same vulnerability to spread across the Internet. 

The Conficker worm will be covered in more detail in 
Akamai's 7st Quarter, 2009 State of the Internet report. 


Destination Port Use % Traffic Q3 08% 





445 Microsoft-DS 22.96 A eAlZ2 
80 www 14.51 9.18 
oun 139 NetBIOS 11.56 21.09 
GhostSurft 22 SSH 10.78 9.73 
135 Microsoft-RPC WAS 10.68 
VNC Server 1433 Microsoft SQL Server 2.46 3.20 
(multiple) WWW 8000 (multiple) 2.14 0.87 
htcrosokt 5900 VNC Server 2.07 193 
SOL Server 7212 GhostSurf 1.93 0.74 
; 25 SMTP 1.89 2.28 
Microsoft-RPC cepias Various OTHER 256 = 
SSH 
Figure 2: Attack Traffic, Top Target Ports 
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For the first time in 2008, Port 80 (WWW) moved into 
second place in the top 10. SQL injection attacks cont- 
inued to be a popular attack vector in the fourth quarter, 
as noted in Section 2.5. The significant growth in obser- 
ved attack traffic to this port may be due to scans looking 
for Web servers that are vulnerable to such attacks. 
Interestingly, Port 80 was responsible for over 93% of the 
attacks that were observed to be originating in Sweden. 


Attacks targeted at Port 8000 also grew significantly in 
the fourth quarter, enough to push it into the top 10 
list. Officially,> Port 8000 is used for the “iRDMI” service, 
though it is unclear what this service is, or what it is 
used for. However, the port is also® reportedly used by 

a number of other software packages, and is also often 
used as an alternative default port for HTTP traffic. It is 
not known which piece of software that binds to Port 
8000 was targeted by these attacks. 


Port 7212 also made its first appearance in the top 10 
during the fourth quarter. During the third quarter, this 
port was the top target port for attacks seen from China 
— in the fourth quarter, it was the third most targeted 
port for China-sourced attacks. Please refer to Akamai’s 
3rd Quarter, 2008 State of the Internet report for 
additional details on Port 7212 vulnerabilities. 


% of observed attacks 


Sunday Monday Tuesday 


Figure 3: Attack Traffic, Aggregated by Day of Week 


2.3 Attack Traffic, By Day 

After previous issues of Akamai’s State of the Internet 
report were published, it was suggested that attack traffic 
patterns may have a correlation with Microsoft's “Patch 
Tuesday” updates — a so-called “Attack Wednesday” 
following the Tuesday release of patches by Microsoft, as 
attackers looked for unpatched systems in order to exploit 
those specific vulnerabilities. However, looking at obser- 
ved attack traffic from the fourth quarter, aggregated 

by day of week, it does not appear that this suggested 
correlation necessarily holds, as is shown in Figure 3. 


In fact, it appears that Wednesdays accounted for the 
lowest percentage of weekday traffic during the fourth 
quarter, though still ahead of the percentage of attacks 
that was observed on Saturdays and Sundays. 


However, looking at attack traffic by day across the 
quarter, a significant increase occurred on November 19, 
and attack traffic remained elevated throughout the rest 
of the quarter, as shown in Figure 4. 


It is interesting to note that November 19 is, in fact, 
a Wednesday, but did not follow a “Patch Tuesday” 
release — Microsoft Security Bulletins MSO8-0687 and 
MS08-069% were released a week prior. However, the 





Wednesday Thursday Friday Saturday 
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Figure 4: Attack Traffic, by Day of Quarter 


peak seen on December 18 did follow an out-of-band 
update? issued by Microsoft that addressed a critical 
vulnerability in some versions of their Internet Explorer 
Web browser, and the near-doubling of attack traffic 
seen on that day may be related to that vulnerability. In 
addition, the massive spike that was seen on December 
5 followed the posting of an “Advanced Notification” 
by Microsoft of the security bulletins that were going to 
be released the following Tuesday. Again, this increase in 
attack traffic may have been related to attackers rushing 
to exploit the related vulnerabilities ahead of patches 
being issued. Finally, the spike seen on December 22 can 
likely be correlated with a security advisory issued that 





11/13/08 11/20/08 11/27/08 12/4/08 12/11/08 12/18/08 12/25/08 


day"' by Microsoft, warning that systems running various 
older versions of SQL Server were vulnerable to attack, 
and the traffic seen that day has a high likelihood of 
being attempted SQL injection attacks. 


Comparing the levels of attack traffic targeted at the 

top three Microsoft-related ports (445, 139, and 135) 
aggregated across the fourth quarter, and charting the 
levels by day of week, they all appear to follow a similar 
pattern. The number of attacks reaches the highest levels 
early in the week, bottoming out on Thursday, and then 
increasing again into the weekend, as shown in Figure 5. 
This traffic pattern may also be influenced by Microsoft's 
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Figure 5: Attack Traffic Targeting Ports 445, 139, and 135 by Day of the Week 
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practice of releasing major patches on Tuesday — 
vulnerabilities are exploited ahead of the patch releases, 
and then as compromised systems are patched, attack 
volume decreases. 


2.4 Distributed Denial of Service 

(DDoS) Attacks 
The Internet celebrated an auspicious occasion on 
November 2, 2008, the 20th anniversary of the “Morris 
Worm", arguably the first major denial of service attack 
on the Internet. According to a published report,'? the 
worm was written by then Cornell University student 
Robert Tappan Morris, who was later convicted of com- 
puter fraud for the incident. Morris is now an associate 
professor of computer science at MIT. Launched on 
November 2, 1988, the Morris worm disabled approxi- 
mately 10% of all Internet-connected systems. The worm 
was a self-replicating program that exploited known 
weaknesses in common utilities including e-mail software 
sendmail, as well as Finger, a tool that showed which 
users were logged on to a given computer. 


Several high-profile Web sites suffered DDoS attacks 
during the fourth quarter. The BBC Web site was subjec- 
ted to a DDoS attack on November 6 that crippled the 
Web site’s performance significantly. During the attack, 
the BBC Web site responded very slowly, and measure- 
ments made by monitoring service Pingdom showed that 
for a total of 1 hour and 15 minutes it did not respond 
at all.'? The Web site for “NO on Prop 8” (opposing 
Proposition 8, which would eliminate same-sex couples’ 
right to marry in California) was hit by a DDoS attack 
that took the site down for several hours on October 29, 
with attack traffic originating from computers not just 
within California, but also from Texas, New Jersey and 
Georgia.'* The Wordpress.com blog platform (hosting 


more than 4.5 million blogs) was subjected to a DDoS 
attack on October 27 that caused some of its blogs to 
become unavailable for a period of time. Wordpress.com 
has three origin data centers and was able to reroute 
the relevant traffic to unaffected servers once the DDoS 
attack had been identified and isolated.'* 


2.5 Web Site Hacks & Web-Based Exploits 

In December, the Koobface virus resurfaced on Facebook. 
The virus leverages malware unknowingly downloaded by 
users, which sends out messages to their Facebook friends, 
urging them to click on a link that takes them to an infec- 
ted Web site,'° as well as hijacking search requests made 
to popular search sites such as Google, Yahoo, and MSN. 


As discussed in the previous two issues of the State of the 
Internet report, cross-site scripting (XSS) continues to be 

a problem. In October, Yahoo fixed an XSS error in the 
hotjobs.yahoo.com domain that allowed attackers to in- 
ject JavaScript code into the page that silently copied the 
cookies used to authenticate Yahoo users when they log 
in to sections of the site that require a password. Attack- 
ers, using these cookies, then had broad control over the 
victim’s Yahoo account, including Yahoo e-mail and any 
other service that uses authentication cookies belonging 
to the yahoo.com domain."” In December, it was discovered 
that an XSS error on americanexpress.com allowed attack- 
ers to steal users’ authentication cookies, which are used 
to validate American Express customers after they enter 
their login credentials.'® However, the security hole was 
closed within an hour after an article about it was posted 
on IT news Web site The Register. Four XSS bugs on the 
Facebook Web site were also publicized and quickly 
addressed in December. '? 
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SQL injection once again continued to be a popular 
vector for Web-based attacks during the fourth quarter. 
Two Adobe Web sites, Vlog It and Serious Magic, were 
compromised through SQL injection in October, accord- 
ing to Internet security firm Sophos.?° In November, 
security firm Kaspersky Lab discovered 1,200 Web sites 
around the world that had been compromised by an SQL 
injection attack that appeared to originate from China.*! 
In late December, Microsoft issued a warning”? about a 
critical bug in its SQL server software that could be 
exploited by attackers. 


As initially described in the 3rd Quarter, 2008 State of 
the Internet report, the Web-based attack vector known 
as “clickjacking” gained additional exposure during the 
fourth quarter. In early October, an Israeli research 
released a proof-of-concept demo that highlighted the 
threat posed the clickjacking flaw.”? Days later, Adobe 
posted” a workaround procedure to help mitigate 
exposure, and subsequently released a Flash Player 
update? that addressed the security vulnerabilities. 


In October, a researcher at Aladdin Knowledge Systems 
announced that that he had discovered a cache of user- 
names and passwords for over 200,000 Web sites, 
including 80,000 that had been modified with malicious 
content.?° According to the researcher, the 200,000 
compromised sites included those belonging to govern- 
ments, Fortune 500 companies, universities and other 
businesses; more than half of the affected sites belonged 
to European companies and organizations. Other Web 
sites hacked in the fourth quarter included those belong- 
ing to online bill payment company CheckFree,”” the 
Ohio Secretary of State,?® and the World Bank.?? 


2.6 TCP-Based Attacks 

As noted above in Section 2.2, the Conficker worm 
exploits services running on TCP port 445, and was iden- 
tified as a key component in a botnet that was estimated 
to include approximately half a million compromised 
systems by early December.*° The Conficker worm will 
be covered in more detail in Akamai's 7st Quarter, 2009 
State of the Internet report. 


2.7 McColo Shutdown 

In mid-November, hosting provider McColo Corp. was 
disconnected from the Internet. Identified as a major host 
of organizations engaged in sending unsolicited e-mail 
(“spamming”), it was reported that McColo had been 
responsible for up to 75% of all spam sent each day.*! 


In addition to reducing spam volumes across the Internet, 
the disconnection of McColo also served to disrupt the 
“Rustock” and “Srizbi” botnets, crippling an estimated 
500,000 compromised systems (“bots”).22 Although 

the Srizbi botnet control servers resurfaced at an ISP in 
Estonia, that ISP quickly cut off connectivity to those 
servers.?? Unfortunately, the Srizbi bots gradually 

became active again through updates to their code, and 
it appeared that several weeks after the McColo shut- 
down that spam volumes were once again on the rise.** 
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2.8 SSL Vulnerability 

On December 30, it was announced at the 25th Chaos 
Communication Congress that researchers had found a 
way to target a known weakness in the MD5 algorithm 
to create a rogue Certification Authority (CA) that would 
allow them to create “fake” SSL certificates that would 
still be fully trusted by all modern Web browsers.*° As of 
the time of the announcement, at least six CAs were 
using the MD5 algorithm to sign SSL certificates, and the 
researchers estimated that 30-35% of all SSL certificates 
currently in use had an MD5 signature somewhere in 
their authentication chain.*° 


Because the digital signature on the fake certificate 
appears to come from a reputable and presumably trust- 
worthy CA, a user’s browser will accept it and indicate to 
the user that the connection is secure. Coupled with the 
DNS attack described by Dan Kaminsky, users could be 
redirected to malicious sites without being aware of it. 
These rogue e-commerce or banking sites, for example, 
would appear trusted, and could make the collection of 
login or other personal data fairly simple for an attacker 
without raising a user's suspicion. 


Two days after the announcement, VeriSign announced 
that they would be transitioning from the MD5 algorithm 
to the SHA-1 algorithm for digital certificates they issued, 
and security researchers encouraged other CAs to do 

the same.?” 


2.9 DNSSEC 

Following the DNS exploit described by Dan Kaminsky 

in the third quarter, and the subsequent push for the 
implementation of DNSSEC, the Internet Corporation for 
Assigned Names and Numbers (ICANN),*® VeriSign,?? and 
the United States Department of Commerce National 
Telecommunications and Information Administration 
(NTIA)*® all issued proposals regarding the cryptographic 
signature of the DNS root zone. NTIA invited interested 
stakeholders to file comments on the proposals, and 
received more than 30 comments in favor of securing 
the root zone. Commenters included representatives of 
the Internet Architecture Board, the Internet Society, 
Akamai Technologies, NeuStar, Afilias, and Comcast.*" 


In the meantime, seven leading domain name vendors, 
representing more than 112 million domain names 
(65% of all registered domain names) formed the 
DNSSEC Industry Coalition to work together to drive the 
adoption of DNSSEC across all domain name registries 
and registrars around the world.” Participants in the 
coalition include VeriSign (.com, .net), The Public Interest 
Registry (.org), Nominet UK (.uk), Afilias (.info), NeuStar 
(.biz, .us), the Foundation for Internet Infrastructure (.se), 
and Educause (.edu). While the primary goal of the 
coalition is to accelerate the deployment of DNSSEC, 

the participants noted that it would be “unrealistic” to 
set forth a timetable for deployment until the issues 


surrounding signature of the DNS root zone are resolved. 


The fourth quarter of 2008 saw another significant 
network outage in the Mediterranean, as a result of three 
undersea cables being severed. A peering dispute between 
Sprint-Nextel and Cogent Communications effectively 
partitioned the Internet, preventing single-homed custo- 
mers of both providers from reaching one another. In 
addition, a number of high profile Web sites experienced 
availability problems throughout the quarter due to a 
variety of reasons, including power outages and flash 
crowds. Many new WiMAX initiatives were announced, 
which are likely to bring wireless broadband connectivity 
to users in countries around the world, and new fiber-to- 
the-home initiatives and DOCSIS 3.0 rollouts brought 
extremely high-speed wired broadband connectivity to 
users in North and South America, Asia, and Europe. 


3.1 Network Outages 

On December 4, equipment failure caused a complete 
loss of Internet connectivity for two of the three ISPs in 
Haiti that connect to the Internet through the ARCOS 
submarine cable. The outage lasted for approximately 
three-and-a-half hours until traffic was re-routed through 
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an alternate submarine cable through Puerto Rico.” 
On December 8, over a million subscribers of Time 
Warner Cable saw their Internet connectivity impaired 
for approximately two-and-a-half hours due to the 
failure of Time Warner's DNS servers.“ 


Eerily echoing events of January 2008, on the morning 
of December 19, three key underwater cables in the 
Mediterranean (SeaMeWe-3, SeaMeWe-4 and FLAG) 
were severed, which impacted Internet traffic in the 
Middle East and the Indian subcontinent.*° According 

to measurements from Renesys, more than 1,400 of 
Egypt's and more than 450 of India‘s globally routed 
prefixes (networks) suffered outages, as shown in Figure 
6. Repairs to the SeaMeWe-3 and SeaMeWe-4 cables 
began two days later, as the repair ship “Raymond 
Croze” was dispatched by France Telecom.*® Unfortu- 
nately, as France Telecom finished repairing the 
SeaMeWe-4 cable on December 25, the cable broke 
again in a different place, which pushed out repairs until 
approximately 10 days later than originally expected.*” 





Egypt Saudi Arabia Maldives Bangladesh Sri Lanka Sudan UAE Lebanon Pakistan India 


Figure 6: Network Outages by Country (Data courtesy of Renesys) 
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A Reuters article*® noted that the three severed cables 
were the most direct route for moving traffic between 
Western Europe and the Middle East, and that Verizon 
had rerouted some of its traffic by sending it across 

the Atlantic, then the United States, across the Pacific, 
and on to the Middle East. It is important to note that 


3.2 Routing Issues 

On November 10, Companhia de Telecomunicacoes do 
Brasil Central (CTBC) inadvertently leaked a nearly-full 
set of routing information to two of its upstream network 
providers, in essence hijacking most of the Internet's 
address space. The data was not generally propagated 
Akamai's services can help customers maintain consistent to the Internet at large, though, preventing another 

site and application performance and availability when 
such cable cuts occur, and when alternate routes force 
traffic across continents and oceans. Figure 7 illustrates Internet report for additional details on the YouTube 

the results of a performance test for a customer portal issue.) Ultimately, the leak had no significant global impact. 
hosted in Europe, as seen by Akamai’s AsiaPac measure- However, it did make its way to RIPE’s route collector in 
ment agents. As shown, the measurement agents saw a Sao Paolo, Brazil, where a volunteer-based route monitor- 
significant degradation in performance when trying to 
retrieve content from the origin during the two days 
before repairs began. However, portal performance as 
delivered by Akamai’s IP Application Accelerator service 
remained consistent throughout the duration of the 
cable cut, as Akamai is able to identify and send traffic 
over alternative network paths on a real-time basis. 


YouTube-like issue that occurred earlier in the year. (See 
Section 3.3 of Akamai’s 7st Quarter, 2008 State of the 


ing project noticed the leaked announcement and 
notified subscribers via e-mail of the hijacking.*? While 
there was little impact to the Internet as a whole, the 
event served to underscore the challenges that surround 
monitoring for, and alerting on, significant route changes. 
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Figure 7: Akamai Download Performance Remained Consistent Despite Cable Cut 
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3.3 Peering Issues 

On October 30, the network link between Cogent and 
Sprint-Nextel disappeared; from a routing perspective — 
Sprint de-peered Cogent. As a result, customers of 
Cogent lost access to networks connected to Sprint, and 
vice-versa.°° Cogent is no stranger to peering disputes, 
and had been involved in at least four prior incidents over 
the last six years — AOL in 2003, France Telecom in 
2006, Level 3 in 2005 and TeliaSonera in March 2008.°! 
A related post®? on the Renesys blog noted that 289 
autonomous systems (networks) are completely single- 
homed (have no connectivity to the Internet through 
anyone else) behind Cogent, and that 214 are completely 
single-homed behind Sprint. In addition, Renesys noted, 
due to Cogent’s aggressive pricing, there are a large 
number of service providers that are multi-homed but 
that send all of their outbound traffic through Cogent by 
default. Consequently, this de-peering prevented traffic 
originating from those users from reaching Sprint- 
connected users. Unsurprisingly, Sprint PCS was one of 
the networks single-homed to Sprint's network, meaning 
that users of mobile devices using Sprint's cell phone 
services may have had problems connecting to Web sites 
and online services connected to Cogent. 


Published reports? indicated that the peering dispute 
was sourced in a disagreement over payments that Sprint 
claimed it was owed for ongoing traffic exchange after a 
peering trial that ended in September 2007 — Cogent's 
executives believed that the results of the trial had 
qualified them for settlement-free peering. However, 

on November 2, Sprint re-enabled the connection with 
Cogent,°** and on December 22, Sprint and Cogent 
announced that they had reached a multi-year intercon- 
nection agreement for the purposes of exchanging 
Internet traffic. 


3.4 Web Site Outages 

The Web site of file sharing service Yousendit was 
unavailable for over 5 hours in total, due to four separate 
outages that occurred on November 17. The shortest 
outage lasted 30 minutes and the longest lasted 2 hours 
and 25 minutes.°° XCalibre Communications’ FlexiScale 
on-demand utility computing platform experienced 
another big outage in late October. The outage lasted 
approximately 18 hours and was reportedly due to near- 
simultaneous failures in the switches that connect the 
storage to the processing nodes.*” Google’s Gmail service 
continued to have problems in the fourth quarter, 
experiencing an outage starting on October 15 that 
lasted approximately 30 hours.°® Some additional avail- 
ability issues impacting Gmail reportedly also occurred 
on Monday, October 20.%° 


Problems dealing with “flash crowd” traffic also caused 
outages at a number of Web sites during the fourth 
quarter. The Openoffice.org site crashed on October 14, 
due to overwhelming demand for its new 3.0 software 
release.© The Europeana digital library enjoyed a high- 
profile launch on November 20, but the system was 
swamped by an unexpected 10 million user requests per 
hour and crashed within 24 hours of its launch.®' The 
Web site for Dr. Pepper was unavailable for large parts 
of the day on November 23, as the result of a surge of 
traffic related to a one-day marketing promotion that 
promised everyone in America a free bottle of soda if 
the new Guns n’ Roses album was released during 2008. 
Dr. Pepper ultimately elected to extend the offer an extra 
day and add more server capacity to handle the load. 
Web sites can leverage the on-demand capacity available 
through Akamai’s site delivery services to help them 
avoid traffic-related site downtime or the need to add 
additional server capacity. 
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High traffic levels and application problems combined to 
take various U.S. Postal Service Web-based services 
offline the week of December 8. Several different online 
tools, including the Postal Service's popular Click-N-Ship 
service, suffered outages.®? Most tools were available 
again by Monday afternoon, but the Click-N-Ship service 
was not fully functional again until Friday, December 12.% 


A number of social networking and related sites 
experienced varying amounts of downtime in the fourth 
quarter. The blog search engine Technorati experienced 
both downtime and slower performance for more than 
nine hours on December 12 and 13.% Dating website 
Match.com experienced technical difficulties and was 
unavailable for more than an hour and a half on October 
29.° Business networking site LinkedIn was down for 
over an hour on October 10,°’ and experienced an 
additional hour-long outage on November 16.%° Hosted 
blogging service Typepad was down for an hour on 
October 3,°° and micro-blogging service Twitter exper- 
ienced a brief outage on November 13, lasting just under 
an hour, due to a DNS configuration error.”° Popular 
blogging/social networking site LiveJournal was unavail- 
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able for nearly three hours on November 18 while it 
migrated to a new server facility.”’ A “catastrophic” 

UPS failure caused a power outage on November 13 at 

a Santa Clara data center operated by Quality Technology 
Services, triggering days of performance problems for 
the social network Friendster. Although the hosting 
facility was back on generator power within two hours, 
Friendster remained offline for more than 23 hours over 
a three day period.’ 


Looking back across all of 2008, Pingdom published”? 

a report entitled “Social Network Downtime in 2008,” 
which analyzed the Web site availability (uptime) of 15 
of the world's largest social networks. Pingdom noted 
that Facebook and MySpace, the two largest social 
networks monitored, both had very little downtime in 
2008. Only four social networks that were monitored for 
the full year achieved overall uptime of 99.9% or better: 
Facebook (99.92%), MySpace (99.94%), Classmates.com 
(99.95%), and Xanga (99.95%). Figure 8 illustrates the 
aggregate downtime (in hours) that Pingdom observed 
for the social networks that it was monitoring. 





Figure 8: Social Network Downtime in 2008, in hours (Data courtesy of Pingdom) 
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3.5 Significant New Connectivity — 

Undersea Cables 
A report published in December by telecommunications 
research firm Telegeography noted” that rapid growth in 
Internet capacity around the world over the last decade 
has led to a diminished role for the United States as an 
Internet hub, with dramatic shifts in the amount of traffic 
that passes through the United States from other conti- 
nents. Telegeography found that in 1999, 91% of data 
from Asia passed through the United States at some 
point on its journey, but by 2008, that had fallen to just 
54%. In 1999, 70% of data from Africa passed through 
the United States, but by 2008, that number decreased 
to just 6%. One key reason for this decline has been 
the growth in inter-regional connectivity made possible 
by numerous submarine cable projects, including those 
covered in previous editions of Akamai’s quarterly 
State of the Internet reports. 


In the Middle East, the Cyprus Telecommunications 
Authority (Cyta) and the Syrian Telecommunication 
Establishment (STE) have agreed’® to upgrade the 
UGARIT submarine cable link between Tartous in Syria 
and Pentaskhinos in Cyprus in order to increase Internet 
capacity between the two countries. The 239km UGARIT 
cable began operations in 1995, and its transmission 
capacity is limited to 622 Mbps, which is also driving the 
two companies to initiate feasibility studies for establish- 
ing a second submarine link between their countries. 


3.6 Significant New Connectivity — Wireless 
Representing possibly the extreme in “wireless” Internet 
connections, in November 2008, NASA reported the first 
successful tests of its Deep Space Network, which is 
modeled after the Earth-bound Internet.’ The Deep 
Space Network relies upon Disruption-Tolerant 
Networking (DTN) that does not assume a continuous 


end-to-end connection — if a link is lost, the 
communication node will store the information until 
the connection is re-established. 


Closer to Earth, O3b Networks continues to sign contracts 
to bring Internet connectivity to remote regions using 
satellites in equatorial orbit. In December 2008, O3b 
announced that Afghani telco Neda Telecommunications 
will deploy its Quick Start service as a means for connect- 
ing to the Internet, though service activation is not 
expected until late 2010.”’ In Libya, users working or 
located in remote areas now have access to satellite- 
based connectivity through portable satellite broadband 
terminals, with speeds up to 444 Kbps.’° Finally, in Dec- 
ember, California-based Viasat announced a plan to put 
a broadband Internet satellite into orbit above the U.S. 

in the first half of 2011.7? According to Viasat, the sat- 
ellite will have an overall throughput of 100 Gbps, which 
it claims should enable it to support 2 Mbps service to 
approximately 2 million subscribers when operational. 
Viasat's plans parallel an effort by Eutelsat in Europe 

to launch a high capacity broadband satellite in 2010. 


Akamai's 3rd Quarter, 2008 State of the Internet report 
noted that Sprint-Nextel had launched the “Xohm”- 
branded WiMAX service in Baltimore, Maryland. During 
the fourth quarter, Sprint-Nextel completed the 
formation of a WiMAX joint venture with Clearwire, 
and re-branded the service as “Clear” .®° The first city 
expected to get the new “Clear” WiMAX service is 
Portland, Oregon in early January 2009.®! 


Internationally, announcements of new WiMAX networks 
surged in the fourth quarter of 2008. During the quarter, 
Telegeography’s CommsUpdate daily briefings® highlight- 
ed announcements of new or expanded WiMAX networks 
in Australia,?? Bahrain,** Barbados,®° Bermuda,*¢ Brazil,®” 
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Cameroon,® lraq,® Italy,°° Jordan,?! Kenya,2? Malaysia, ** 
Montenegro,?? Netherlands,?° Pakistan,2”? Romania,°® 
South Africa,%? Spain,'°° and Sri Lanka.'°! 


Telegeography also highlighted the launch of 3G-based 
mobile broadband services in Canada,'” Japan,'® the 
United Kingdom,'™ and Uzbekistan.'°° 


3.7 Significant New Connectivity — 

Fixed Broadband 
The launch of DOCSIS 3.0 is enabling cable providers 
to roll out higher-speed connectivity options to their 
customers, with Comcast! announcing availability of 
service tiers up to 50 Mbps in multiple cities across the 
United States; Virgin Media! in the United Kingdom 
launching a 50 Mbps service; and UPC Netherlands'%® 
offering access at speeds of 60-120 Mbps. 


A number of announcements were also made regarding 
fiber-to-the-home (FTTH) initiatives in several countries. 
In Switzerland, Swisscom began to connect households 
to the neighborhood fiber-optic nodes they had pre- 
viously deployed.'° In an interesting move, Swisscom will 
be laying several fibers per household to enable invited 
partners in the telecommunications, cable, and utilities 
industries to expand their own fiber-optic infrastructure. 
One fiber will be used by Swisscom, while the others will 
be made available to the potential partners. In November, 
Netherlands telco KPN and FTTH operator Reggefiber 
said that they are planning to roll out a FTTH network 
that could cost as much as 7 billion euros that is planned 
to cover pretty much every part of the Netherlands."'° 
Additional FTTH service announcements were made by 
Brasil Telecom (Brazil),"'' MTNL (India),''* Telefonica 
(Spain),''? Telecom Italia (Italy),'"4 and TTK (Russia).''° 


Also in the fourth quarter, the notion of “homes with 
tails” began to take root, popularized in a New America 


Foundation whitepaper''® published in November. 
According to the paper, the idea is that “Consumers 
may one day purchase and own fiber connections that 
run from their homes. They would then be able to 
connect to a variety of service providers, including today’s 
Internet, television, and telephone services, as well as 
ultra-bandwidth intensive services of the future.” The 
paper’s authors also propose that the fiber would form 
part of the property right in the home. However, they 
note that no market for consumer purchase of fiber 
currently exists, but they are looking at one trial that is 
already ongoing in Ottawa, Canada as a means to test 
their model's feasibility and identify associated challenges 
and insights. 


Also in Canada, the Saskatchewan government 
announced in late November that they aim to have 
100% broadband coverage across the Canadian territory 
within three years under a new CAD $129 million 
infrastructure rollout plan. Regional incumbent telecom 
SaskTel’s fixed broadband network footprint will be 
expanded to cover 100% of the population, up from 
86% coverage today, through an expansion of the 
existing CommunityNet high speed network, upgraded 
rural backbone infrastructure, and a partnership with a 
satellite firm in order to provide access to the most 
remote areas.''” 


Similarly, in November, Finland’s government said''® that 
it will invest up to €66 million ($85.2 million) as part of 
plans to increase high speed broadband coverage across 
the country. The investment is part of an effort to 
increase access to 100 Mbps connectivity in Finland to 
100% of the population by 2016. The expectation is that 
by 2015, approximately 95% of the population will have 
access to the higher broadband speeds through commer- 
cial development, and by 2010 all broadband users are 
expected to be able to receive at least 1 Mbps. In France, 
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the government called on telecommunications 
providers''? to offer broadband services across all its 
territory for a maximum of €35 ($45.15) a month. This 
makes France the first country in the European Union 

to effectively mandate the supply of broadband services. 
France Telecom and SFR plan to include broadband 
among their universal services by the end of 2009. 


In the United States, an economic stimulus bill signed in 
February 2009 reportedly provides $7.2 billion devoted 
to broadband funding, aimed at creating incentives for 
additional infrastructure buildout and the development 
of a comprehensive national broadband plan by the 
FCC.'”° This “broadband stimulus” will be examined in 
more detail in Akamai’s 7st Quarter, 2009 State of the 
Internet report. 


3.8 DNS Expansion 

According to the Domain Name Industry Brief report 
published'?' by VeriSign, 2008 ended with a total of 

177 million domain name registrations across all of the 
Top Level Domains (TLDs), representing 16% growth 
over the previous year and 2% growth over the third 
quarter of 2008. More than 10.1 million new domain 
names were registered across all of the TLDs in the fourth 
quarter of 2008, reflecting slower growth in new regis- 
trations, with a decline of 12% from the third quarter. 


As highlighted in the 2nd Quarter, 2008 State of the 
Internet report, in October, ICANN published a draft 
"Applicant Guidebook” for new generic TLDs, and posted 
it online for review and comment.'#? According 

to published reports, '?? ICANN would charge groups 
$185,000 to apply for a generic TLD, with most of the 
money going toward evaluation of the application. 
ICANN's plan would open up TLDs to non-English 
character sets, and seeks to streamline a TLD-creation 
process that has proven cumbersome in the past. 


However, by the end of the comment period in mid- 
December, the United States Department of Commerce, 
the Australian government, members of the global bus- 
iness community, and over 200 commenters on the posted 
proposal expressed significant opposition to ICANN's plan, 
urging them to “go back to the drawing board and 
propose a process that results in a responsible expansion 
of the name space, not merely a duplication of it.” '*4 


3.9 IPv6 

According to published reports, the adoption of IPv6 
continued a slow, steady growth into the end of 2008. 
A blog post'?° at Internet infrastructure news & opinion 
site CirclelD notes that at the end of the year, 4% of 
autonomous systems on the Internet supported IPv6, 

up from 2.4% at the beginning of 2008. In addition, 

the Number Resource Organization (NRO), which is made 
up of the five Regional Internet Registries (RIRs), announ- 
ced'?6 in early December that the rate of new entrants 
into the IPv6 routing system has increased by approx- 
imately 300 percent over the past two years. Additional 
IPv6 statistics presented at the RIPE 57 meeting in 
October were highlighted in another!’ CirclelD blog 
post, including data on IPvé6 traffic by country, OS 
support, access methods, and |Pv6-related latency. 


However, research presented at the Proceedings of the 
ACM Internet Measurement Conference, based on what 
the researchers claim is “the first complete census of the 
Internet in more than two decades”, discovered a surpri- 
sing number of unused |Pv4 addresses and concluded 
that many will still be unused in two years when |Pv4 
address space was projected to be exhausted.'2° “There 
are huge chunks of IP space which are not allocated yet, 
and also giant swaths which are inefficiently allocated,” 
the researchers noted. 
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4.1 Unique IP Addresses Seen By Akamai 
Through a globally-deployed server network, and by 
virtue of the billions of requests for Web content that 
it services on a daily basis, Akamai has unique visibility 


into the levels of Internet penetration around the world. 


In the fourth quarter of 2008, over 400 million unique 
IP addresses connected to the Akamai network — 
almost six percent more than in the third quarter, and 
over 28 percent more than the same quarter a year 
ago. Similar to the prior two quarters, nearly 30% of 
those IP addresses came from the United States and 
approximately 10% came from China. 


Country Q4 08 fey: ek} YoY 





Unique IP's Change Change 
- Global 401,285,817 +5.67% +28.38% 





Figure 9: Unique IP Addresses Seen By Akamai 


Growth among countries in the Top 10 slowed 
quarter-over-quarter — in the third quarter, three 
countries in the Top 10 saw double digit percentage 
increases, while in the fourth quarter, China was 

the big gainer at just under seven percent quarterly 
growth in unique IPs seen by Akamai’s network. South 
Korea also appears to be establishing a quarterly pattern 
of growth and loss — the country recorded quarterly 
increases in the first and third quarters of 2008, and 
quarterly losses in the second and fourth quarters 

of 2008. For the year, however, South Korea was up 
over 10%, adding approximately 1.5 million unique IP 
addresses seen by Akamai. 


On a global basis, year-over-year, Akamai saw the number 
of unique IP addresses more than double in 19 countries 
— Turks and Caicos led the list with 695% growth. 

(To be fair, this statistic is also influenced by the law 

of small numbers, as they ended 2008 with just under 
2,400 unique IP addresses seen by Akamai.) Sixteen 
countries had a net loss year-over-year in the number of 
unique IP addresses seen by Akamai — most are smaller 
African nations, remote island nations in the Pacific 
Ocean, or countries in the midst of ongoing civil unrest. 


Looking at the “long tail,” there were 187 countries with 
fewer than 1 million unique IP addresses connecting to 
Akamai in the fourth quarter of 2008, 146 with under 
100,000 unique IP addresses, and 38 with fewer than 
1,000 unique IP addresses. As compared to the prior two 
quarters, these country counts remained extremely stable. 
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4.2 Internet Penetration, Global 

How does the number of unique IP addresses seen 

by Akamai compare to the population of each of 

those countries? Asked another way, what is the level 
of Internet penetration in each of those countries? 
Using 2008 global population data’? from the United 
States Census Web site as a baseline, levels of Internet 
penetration for each country around the world were 
calculated based on Akamai’s view into Internet traffic. 
The countries in the Top 10 list shown in Figure 10 were 
stable from quarter-to-quarter, although there was some 
shifting of positions, as Finland, Iceland, the Cayman 
Islands, and the British Virgin Islands were all ahead 

of where they were ranked in the third quarter. Globally, 
the number of unique IP's per capita grew from 0.06 

in the third quarter (and 0.05 in the first quarter) to 
0.08 at the end of 2008. 


These per capita figures should be considered as an 
approximation, as the population figures used to 
calculate them are static estimates — obviously, they 
will change over time, and it would be nearly impossible 
to obtain exact numbers on a quarterly basis. In addi- 
tion, individual users can have multiple IP addresses 
(handheld, personal/nome system, business laptop, etc.). 
Furthermore, in some cases, multiple individuals may be 
represented by a single IP address (or small number of 
IP addresses), as they access the World Wide Web 
through a firewall proxy server. Akamai believes that it 
sees approximately 1 billion users per day, though we 
see only approximately 400 million unique IP addresses. 


© 2009 Akamai Technologies, Inc. All Rights Reserved 1 





Unique IP’s 
1-1 a Gf) 0) |} 


- Global 0.08 





Figure 10: Global Internet Penetration 


oO 


Section 4: Internet Penetration (ont’a) 


Section 5: Geography 





4.3 Internet Penetration, United States 

For the second consecutive quarter, Akamai is examining 
the level of Internet penetration within the United 
States. Using state population estimates available from 
the United States Census Web site,'?° and the number 
of unique IP addresses from each state that Akamai 
saw during the fourth quarter, we calculated the levels 
of Internet penetration on a state-by-state basis. The 
same caveats noted immediately above in section 4.2, 
regarding per capita figures as an approximation, 
apply here as well. 





Figure 11: Internet Penetration in the United States 


As shown in Figure 11, many states experienced 
moderate increases in Internet penetration quarter-over- 
quarter, while it appears that Virginia and New Jersey 
appear to have experienced significant decreases. It is 
not clear whether this is the beginning of a longer-term 
trend for these states, or just a one-time anomaly. Future 
editions of this report will continue examine ongoing 
trends in levels of Internet penetration. 


State Unique IP’s 
Per Capita 


20 © 2009 Akamai Technologies, Inc. All Rights Reserved 


Through its globally deployed server network and by 
virtue of the billions of requests for Web content that it 
services on a daily basis, Akamai has a unique level of vis- 
ibility into the connection speeds of those systems issuing 
the requests, and as such, of broadband adoption around 
the globe. Because Akamai has implemented a distributed 
network model, deploying servers within edge networks, 
it can deliver content more reliably and more consistently 
at those speeds, in contrast to centralized competitors 
that rely on fewer deployments in large data centers. 

For more information on why this is possible, please see 
Akamai's How Will The Internet Scale? white paper.'? 


The data presented below was collected during the 
fourth quarter of 2008 through Akamai’s globally- 
deployed server network and includes all countries and 
U.S. states that had more than 1,000 average monthly 
unique IP addresses make requests to Akamai’s network 
during the fourth quarter. For the purposes of classifi- 
cation in this report, the “broadband” data included 
below is for connections greater than 2 Mbps, and 

“high broadband” is for connections 5 Mbps or greater. 
In contrast, the “narrowband” data included below is for 
connections slower than 256 Kbps. Quarter-over-quarter 
and year-over-year changes are shown in an effort to 
highlight general and longer-term trends. 


As the quantity of HD-quality media increases over time, 
and the consumption of that media increases, end users 
are likely to require ever-increasing amounts of band- 
width. A connection speed of 2 Mbps is arguably 
sufficient for standard-definition TV-quality video con- 
tent, and 5 Mbps for standard-definition DVD-quality 
video content, while Blu-Ray (1080p) video content has 
a maximum video bit rate of 40 Mbps, according to the 
Blu-Ray FAQ.'%2 


5.1 Average Connection Speeds, Global 

This quarter, the State of the Internet report will begin 
tracking average connection speeds for countries around 
the world. While quarterly variances are likely, we expect 
that over the long term, the overall trend will be towards 
higher average connection speeds as levels of broadband 
adoption continue to grow. Current highlights and his- 
torical trends for average connection speeds on a global 
basis can be found in Akamai’s new data visualization 
tool, available at http://www.akamai.com/av5. 


Globally, the average connection speed was approximately 
1.5 Mbps — the speed of a T-1 Internet connection. 
Looking at the top 10 globally, South Korea ranks first 
with average connection speed of 15 Mbps — 10x the 
global average. As has been discussed previously, with 
regard to the adoption of high broadband Internet 
connections, Asia and Northern Europe hold the majority 
of the spots in the top 10, as shown in Figure 12. 


The United States ranked 17th globally, with an average 
connection speed of 3.9 Mbps, up approximately 8% from 
the average connection speed for the first quarter of 
2008. We expect that this average speed will continue to 
grow over time, as new technologies, such as DOCSIS 3.0 
(as described in Section 3.7) enable consumer broadband 
connections to reach significantly higher speeds. 


5.2 Average Connection Speeds, United States 
In December, PCMag.com published an article titled 

“The Fastest ISPs in America — and Where You Live.” '?? 
Leveraging their own SurfSpeed application (“a utility that 
grabs pages and page elements from several popular Web 
sites to measure actual Internet surfing speed”), PCMag 
collected data points from more than 17,000 unique IP 
addresses, comprising over 200,000 individual tests, and 
then analyzed the results to find the fastest ISPs in the 
United States, as well as ranking each state on average 
download speed. In addition, The Communications 
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Figure 12: Average Internet Connection Speed by Country 


Workers of America (CWA) published a report in 
August 2008 titled “A Report on Internet Speeds in 
All 50 States”'*4 that included median speeds as 
calculated from nearly 230,000 people who took a 
speed test at the speedmatters.org Web site between 
May 2007 and May 2008. 


Based on the billions of requests for Web content that 
Akamai services on a daily basis, we are also able to 
calculate the average connection speeds of users across 
the United States. Looking back over all of 2008, most 
states saw nominal to significant increases in their 
average broadband speed, with both Nebraska and 
Kentucky seeing a 33% improvement from the first 
quarter to the fourth quarter. Several states, including 
Rhode Island and New Jersey, saw minor decreases over 
the course of the year. 


Interestingly, the data aggregated and analyzed by 
Akamai in the fourth quarter diverges significantly from 
that presented in the PCMag article, and more nominally 
from that presented in the CWA paper. For all states, 
Akamai’s average observed connection speeds were 
significantly higher than those calculated by PCMag 


Mbps 





— they diverged by a factor of anywhere between 4.1x 
(Illinois) and 13.2x (Vermont). Akamai’s full data set, 
and a comparison to the data from the PCMag and 
CWA studies is shown in Figure 13. 


There are several likely reasons for the divergence in 
observed connection speeds. One possible explanation is 
the vast difference in sample sizes — the PCMag study 
encompassed data from only 17,000 unique IP addresses, 
and the CWA study from 230,000, while Akamai’s study 
included data from more than 100 million unique IP 
addresses. Another possible explanation is that PCMag's 
study collected data only from computers connected to 
consumer ISPs — that is, home computers, whereas 
Akamai's collects data from computers connected to 
both consumer and commercial Internet connections — 
the latter are most frequently much faster. The CWA 
paper notes “Most people who went to speedmatters. 
org to take the speed test used a DSL connection, a cable 
modem, or a fiber connection.” While not explicitly 
stated, it may be inferred that their users were also likely 
on consumer ISP connections. However, it’s not clear that 
these possible explanations account for differences that 
exceed an order of magnitude in some cases. 
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AKAMAI STATE AKAMAI Q4 08 PCMAG CWA MEDIAN 
RANK AVERAGE (KBPS) SURFSPEED (KBPS) (KBPS) 

1 Delaware 7280 646 6685 

2 lew Hampshire 6088 615 2877 

3 Connecticut 5425 716 2888 

4 lew York 5373 714 4142 

5 Rhode Island 5334 516 6769 

6 levada 5191 781 2815 

7 Vermont Si 391 1890 

8 Oklahoma 5111 695 1856 

9 jaine 5074 427 2558 

0 Utah 5008 517 2324 
11 ndiana 4924 524 2301 

2 jassachusetts 4882 695 4564 
13 Wisconsin 4495 402 2372 

4 Oregon 4399 665 2624 
15 California 4361 666 2470 

6 lebraska 4354 707 2032 
17 ennessee 4313 474 2755 

8 Virginia 4295 765 5033 
19 Kentucky 4252 547 1795 
20 Pennsylvania 4177 747 2396 
21 South Carolina 4141 457 2849 
22 ichigan 4023 544 2573 
2 innesota 3055 609 1566 
24 Ohio 3953 600 2523 
25 orth Carolina 3925 534 2925 
26 Colorado 3831 564 2341 
Dh Florida 3792 562 3988 
28 West Virginia 3761 417 1987 
29 lew Mexico 3734 372 2003 
30 aryland 3718 691 3981 
31 jowa 3713 398 1455 
32 Arizona 3632 505 2172 
33 Alabama 3626 556 2213 
34 orth Dakota 3565 593 1164 
35 Louisiana 3448 470 2706 
36 lew Jersey 3426 727 5825 
37 Washington 3396 625 3016 
38 Kansas 3366 528 2466 
39 ississippi 3348 413 1567 
40 South Dakota 317 560 2222 
41 exas 3158 605 2526 
42 Hawaii 3114 378 1675 
43 Georgia 306 679 3041 
44 Wyoming 2972 379 1325 
45 Arkansas 2897 402 1342 
46 Illinois 280 681 2522 
47 Idaho 2776 461 1326 
48 Montana 2603 455 1320 
49 Missouri 2422 539 1881 
50 Alaska 2000 402 814 























Figure 13: Measured Connection Speed by State 
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Country % above (oy. ey} YoY 
5 Mbps Change Change 


- Global 19% -0.1% +21% 








Figure 14: High Broadband Connectivity, Fastest International Countries 


5.3 High Broadband Connectivity: 

Fastest International Countries 
At the end of 2008, approximately 19% of Internet con- 
nections around the world were at speeds greater than 
5 Mbps. Based on historical data collected by Akamai, 
this level remained generally consistent over the last three 
quarters of 2008, and represents a 21% increase over 
the average global connection speed at the end of 2007. 


In line with their average connection speed of 15 Mbps, 
and their appearance at the top of the list for the prior 
three quarters, South Korea once again ranked as the 





Figure 15: Global High Broadband Penetration 


country with the highest percentage of connections at 
high broadband (>5 Mbps) speeds. Over the course of 
2008, South Korea's rate of quarterly change appeared 
to be locked into a cyclical pattern, with quarterly 
decreases being recorded in the first and third quarters, 
and increases seen in the second and fourth quarters. 
For the whole year, South Korea saw a modest 7% 
increase in their levels of high broadband adoption. 


In the fourth quarter, the United States saw a minor 
decline in the percentage of connections to Akamai 
at speeds above 5 Mbps, though the level of high 


Country alte Lam =tnerlelor-Lare| 
IP’s Per Capita 
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Figure 16: High Broadband Connectivity, Fastest U.S. States 


broadband adoption was up 27% for the year. It’s not 
clear what caused the decline in Q4, although published 
reports'?> indicate that many consumers, in order to 
save money, would scale down their broadband service 
(to a lower speed tier), rather than cancelling it outright. 


Looking at the levels of high broadband penetration in 
the fourth quarter, as shown in Figure 15, South Korea, 
Sweden, the Netherlands, Denmark, and Norway had 
more high broadband IP's per capita than in the prior 
quarter. This is consistent with what would be expected 
from the initiatives to bring higher speed connectivity, 
including FTTH efforts, to consumers in these countries, 
as reported in Section 3.7 above, as well as in previous 
issues of Akamai’s State of the Internet report. 








5.4 High Broadband Connectivity: 

Fastest U.S. States 
Maintaining the trend from the prior three quarters 
of 2008, the East Coast of the United States was once 
again very well represented in the Top 10 list of U.S. 
states with the greatest levels of high broadband 
(>5 Mbps) connectivity, taking eight of the top 10 
slots, as shown in Figure 16. Interestingly, six of the 
states in the Top 10 showed quarterly declines in the 
percentage of connections to Akamai at speeds over 
5 Mbps. Looking back across all of 2008, Rhode Island 
was the only state in the Top 10 to see a decline year- 
over-year. Elsewhere, North Dakota, Illinois, Kansas, 
Arizona, Alaska, and Missouri also saw percentages 
drop year-over-year. 


YoY Change 


Figure 17: Greatest Year-Over-Year Increases in High 


Broadband Connectivity 


laltelaMsiney-teley-Tate| 
IP’s Per Capita 


Figure 18: High Broadband Penetration in the United States 


© 2009 Akamai Technologies, Inc. All Rights Reserved 25 


Section 5: Geog ld ohy (Ceorailaleiare)) 





Comparing the states listed in Figure 16 to the list 
of states in Figure 13 that have average measured 
connection speeds above 5 Mbps, Utah is the only 
state not listed in the High Broadband Top 10. 
Akamai’s measurements rank Utah 29", with 23% 
of connections to Akamai at high broadband levels. 


As shown in Figure 17, seven states more than doubled 
their percentage of high broadband connectivity during 
2008, with Maine seeing a remarkable level of growth 
— over 300%. An additional eleven states saw gains 

in excess of 50% year-over-year. 


Looking at high broadband penetration across the 
United States, we see in Figure 18 that seven of the 
Top 10 states are on the East Coast, down from eight 
in the third quarter. Quarterly change was mixed, as 
six states (New York, Washington, Maryland, Oregon, 





Connecticut, Nevada) saw an increase, two states 
(Rhode Island and New Jersey) saw a decrease, and 
two states (Massachusetts and New Hampshire) saw 
flat levels of high broadband penetration. 


Country % above (oy: Sex} YoY 


2 Mbps (ei ar-vate[-) Change 
— Global 57% -0.5% +2.1% 








Figure 19: Broadband Connectivity, Fast International Countries 


5.5 Broadband Connectivity: 

Fast International Countries 
Internationally, the percentage of connections to Akamai 
at speeds greater than 2 Mbps continues to be more 
clustered than the “high broadband” data, with only 
12% separating No. 1 Tunisia (96%) and No. 10 
Germany (84%) — the gap was 20% in the first quarter 
of 2008, 15% in the second quarter of 2008, and 13% 
in the third quarter of 2008. The United States dropped 
further down the list from the third quarter, to No. 35, 
seeing a further 1.7% loss from the third quarter. Overall, 
all of the countries in the Top 10 saw year-over-year 
increases in broadband adoption, while the United States 
saw a nominal decrease year-over-year, as shown in 
Figure 19. Of the countries in the Top 10, Tunisia saw 
the greatest increase at 56%, vaulting into the Top 10 
in the third quarter. Monaco, Denmark, and Germany 
also saw increases in excess of 20%. 


Rounding out the year, European countries continued 

to demonstrate some of the highest levels of broadband 
penetration, holding eight of the Top 10 slots, as seen 

in Figure 20. The United States recorded a slight increase, 
and continued to maintain the 11th place position. 
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Country Broadband 
IP’s Per Capita 


0.04 





- Global 


Figure 20: Global Broadband Penetration 


From a global perspective, penetration effectively 
quadrupled during 2008, from 0.01 broadband IP's per 
capita in the first quarter to 0.04 in the fourth quarter. 


5.6 Broadband Connectivity: 

Fast U.S. States 
Akamai data indicates that the fourth quarter of 2008 
saw eight of the Top 10 states recording a quarterly 
increase in broadband penetration, as shown in Figure 21. 
Year-over-year, all of the states in the Top 10 saw an 
increase, while across the whole country, 11 states 


10 


Figure 21: Broadband Connectivity, Fast U.S. States 









(North Carolina, North Dakota, Utah, Michigan, Georgia, 
Texas, New Jersey, Illinois, Washington, Maryland, and 
Missouri) saw a decline. Missouri lost the most broad- 
band penetration in 2008, declining nearly 30%, while 
North Carolina lost the least, with a 1.0% decline 

over the course of the year. (One possible explanation 
for some of the more significant losses is that a large 
number of connections may have been just above the 
2 Mbps threshold — that is, an average speed decrease 
of just a few Kbps would remove them from being 
classified as “broadband”.) 


% above (oy ek} YoY 
2 Mbps Change Change 
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5.7 Narrowband Connectivity: 

Slowest International Countries 
While broadband adoption continues to increase in 
many countries across the world, many other countries 
are still stuck with low-speed Internet connections, 
with large percentages of their connections to Akamai 
occurring at speeds below 256 Kbps. 


Similar to the prior three quarters, many of the countries 
with the largest percentages of connections to Akamai 
at speeds below 256 Kbps were either island nations 

or on the African continent. Unfortunately, out of the 
Top 10 countries listed in Figure 22, only Malawi and 
Ethiopia saw quarterly decreases in levels of narrowband 





Figure 22: Narrowband Connectivity: Slowest International Countries 


penetration, and extremely minor decreases at that. 

The United States fell one spot to No. 107, and saw a 
17% decrease in narrowband penetration quarter-over- 
quarter, and a 36% decline year-over-year. For the nine 
countries that ended 2008 with over 90% narrowband 
penetration, seven of them saw their percentages 
increase from where they ended 2007. While this is likely 
indicative of generally increased connectivity, it is clear 
that Internet users in these countries are unlikely to be 
consuming HD-quality video any time in the near future. 
(For the fourth quarter, Mayotte and Cuba both had 
average connection speeds below 100 Kbps, while con- 
nections from the other eight countries in the Top 10 
averaged between 100-200 Kbps.) 


Country % below (oy. ek} YoY 
256 Kbps @ar-Vate{-) Change 
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5.8 Narrowband Connectivity: 

Slowest U.S. States 
The District of Columbia continued to have the highest 
percentage of narrowband connections in the fourth 
quarter as observed by Akamai, though the percentage 
is trending in the right direction, with a nearly seven 
percent quarterly decline. All of the states in the 
Narrowband Top 10 demonstrated quarterly declines, 
with Washington and Illinois declining over 40%, and 
Georgia declining nearly 30%, as shown in Figure 23. 


Missouri stood alone as the only state in the Top 10 to 
show an increase in narrowband penetration year-over- 
year, and in fact, was one of only two states in the 
country to do so. (The other state was Utah, with a 
surprising 30% increase.) Overall, twenty-four states 
demonstrated four consecutive quarters of declining 
narrowband penetration. 








Country % below (oy. ek} YoY 
256 Kbps ei at-late{-) Change 


Figure 23: Narrowband Connectivity: Slowest U.S. States 


Seven states saw a greater than 50% decline in their 
narrowband connections during 2008, as shown in 
Figure 24. An additional eight states saw narrowband 
penetration decline in excess of 40%, and only two 
states (New Jersey and Michigan) saw declines below 10%. 


YoY Change 


Figure 24: Greatest Year-Over-Year Decreases in 
Narrowband Connectivity 
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The Akamai Difference 

Akamai® provides market-leading managed services for powering rich media, dynamic 
transactions, and enterprise applications online. Having pioneered the content delivery market 
one decade ago, Akamai’s services have been adopted by the world’s most recognized brands 
across diverse industries. The alternative to centralized Web infrastructure, Akamai’s global 
network of tens of thousands of distributed servers provides the scale, reliability, insight and 
performance for businesses to succeed online. An S&P 500 and NASDAQ 100 company, 
Akamai has transformed the Internet into a more viable place to inform, entertain, interact, 
and collaborate. 
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